SHIPP, A. 

Appl.No. 10/500,958 

Amendment Accompanying Request for Continued Examination 

AMENDMENTS TO THE CLAIMS; 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims; 

Claim 1 (Currently Amended): A content scanning system for electronic documents 
such as emails comprising: 

a) a link analyser configured op e rativ e to identify hyperlinks in [[the]] content of 
electronic documents; 

b) a hyperlink replacer configured op e rative to modify the electronic documents by 
replacing hyperlinks to external objects identified by the link analyser by new hyperlinks to 
respective targets on a trusted server; and 

c) a link database, the hyperlink replacer being configured to store in the link 
database data relating the replaced hyperlinks to the new hyperlinks; and 

d) [[c)]] an object server configured, operativ e on receipt of a request to retrieve an 
external object from one of said targets on the trusted server when a new hyperlink to said one of 
said targets is selected, to use the data stored in the link database to determine the replaced 
hyperlink which was replaced by the new hyperlink, to retrieve the external object referenced by 
the thus determined, replaced hyperlink, and to cause a content scanner to scan the retrieved 
external object r e f e r e nc e d by th e hyp e rlink which was r e plac e d by th e n e w hyp e rlink to said on e 
of said targ e ts and to determine the acceptability of the retrieved external object according to 
predefined rules, the object server being configured op e rative , responsive to [[a]] the replaced 
hyperlink being to an external object which is determined by the content scanner to be 
acceptable, to r e tri e v e th e e xt e rnal object and supply the retrieved external object [[it]] in 
response to the request, and the object server being configured op e rativ e, responsive to [[a]] the 
replaced hyperlink being to an external object which is determined by the content scanner to be 
unacceptable, to perform remedial action. 
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Claim 2 (Currently Amended): A system according to claim 1 wherein the link 
analyser and the object server are configured op e rativ e to recursively process hyperlinks 
identified in external objects. 

Claim 3 (Previously Presented): A system according to claim 2 in which only a 
maximum depth of recursion is permitted and the document is flagged as unacceptable if that 
limit is reached. 

Claim 4 (Previously Presented): A system according to claim 1 wherein the remedial 
action comprises one or more of: 

flagging or modifying the document to indicate that the content scanner has found the 
object to be unacceptable; 

modifying the document by replacing the hyperlink by a non-functional hyperlink; and 

quarantining the document and sending the intended recipient an alert advising the 
recipient that this has been done. . ' 

Claim 5 (Currently Amended): A method of content-scanning electronic documents 
such as emails comprising: 

a) using a link analyser to identify hyperlinks in [[the]] content of electronic 
documents; 

b) modifying the electronic documents by replacing hyperlinks to external objects 
identified by the link analyser by new hyperlinks to respective targets on a trusted server and 
storing data relating said replaed hyperlinks to said new hyperlinks : 

c) responsive to a request to retrieve an external object from one of said targets on 
the trusted server when a new hyperlink to said one of said targets is selected, using the stored 
data to determine the replaced hyperlink which was replaced by the new hyperlink, retrieving the 
external object referenced by the thus determined, replaced hyperlink , and using a content 
scanner to scan the retrieved external object r e f e r e nc e d by th e hyp e rlink which was r e plac e d by 
th e now hyperlink to on e of said targets and to determine the acceptability of the retrieved 
external object according to predefined rules; 
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d) responsive to [[a]] the replaced hyperlink being to an external object which is 
determined by the content scanner to be acceptable, r e tri e ving th e e xt e rnal obj e ct and supplying 
the retrieved external object [[it]] in response to the request; and 

e) responsive to [[a]] the replaced hyperlink being to an external object which is 
determined by the content scanner to be unacceptable, performing remedial action. 

Claim 6 (Previously Presented): A method according to claim 5 wherein the steps a) 
through e) are used recursively to process hyperlinks identified in external objects. 

Claim 7 (Original): A method according to claim 6 in which only a maximum depth of 
recursion is permitted and the document is flagged as unacceptable if that limit is reached. 

Claim 8 (Previously Presented): A method according to claim 5, wherein the 
remedial action comprises one or more of: 

flagging or modifying the document to indicate that the content scanner has found the 
object to be unacceptable; 

modifying the document by replacing the hyperlink by a non-functional hyperlink; and 

quarantining the document and sending the intended recipient an alert advising the 
recipient that this has been done. 

Claims 9-12 (Canceled). 

Claim 1 3 (Currently Amended): A system according to claim 1 , wherein the object 
server is configured operativ e, responsive to [[a]] the replaced hyperlink being to an external 
object which is determined by the content scanner to be acceptable, to r e tri e v e th e ext e rnal 
obj e ct, further to store the retrieved external object [[it]] on the trusted server and to supply it in 
r e spons e to th e request . 

Claim 14 (Currently Amended): A method according to claim 5, wherein the step of 
r e trieving th e e xt e rnal obj e ct and supplying the retrieved external object [[it]] in response to the 
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request, responsive to [[a]] the replaced hyperlink being to an external object which is 
determined by the content scanner to be acceptable, further comprises storing the retrieved 
external object on the trusted scanner. 

Claim 1 5 (Previously Presented): A method of content-scanning electronic documents 
comprising: 

a) identifying first hyperlinks in contents of electronic documents; 

b) modifying the electronic documents by replacing the identified first hyperlinks 
with different second hyperlinks which point to a trusted server; 

c) storing data to relate the second hyperlinks to the first hyperlinks; 

d) in response to a request received by the trusted server when one of the second 
hyperlinks is selected, using the stored data to determine the first hyperlink corresponding to the 
selected second hyperlink and retrieving an object using the determined first hyperlink; 

e) scanning the retrieved object in accordance with specified rules; 

f) making the retrieved object available in response to the received request if the 
retrieved object is determined to be acceptable in accordance with the specified rules; and 

g) performing remedial action if the retrieved object is not determined to be 
acceptable in accordance with the specified rules. 

Claim 16 (Previously Presented): The method according to claim 15, further 
comprising: 

generating the second hyperlinks based on one or more of a name of the trusted server, a 
time, a process identifier, a count that increments for each second hyperlink and a random 
number. 

Claim 17 (Previously Presented): An e-mail gateway comprising a trusted server 
configured to scan e-mail, the trusted server programmed to perform operations comprising: 

a) identifying first hyperlinks in contents of e-mails; 

b) modifying the e-mails by replacing the identified first hyperlinks with different 
second hyperlinks which point to a trusted server; 
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c) storing data that relates the second hyperlinks to the first hyperlinks; 

d) in response to a request received by the trusted server when one of the second 
hyperlinks is selected, using the stored data to determine the first hyperlink corresponding to the 
selected second hyperlink and retrieving an object using the determined first hyperlink; 

e) scanning the retrieved object in accordance with specified rules; 

f) making the retrieved object available in response to the received request if the 
retrieved object is determined to be acceptable in accordance with the specified rules; and 

g) performing remedial action if the retrieved object is not determined to be 
acceptable in accordance with the specified rules. 

Claim 18 (Previously Presented): The e-mail gateway according to claim 17, wherein 
the trusted server is programmed to perform further operations comprising: 
identifying a third hyperlink in the retrieved object; 

modifying the retrieved object by replacing the identified third hyperlink with a different 
fourth hyperlink which points to the trusted server; and 

storing data that relates the fourth hyperlink to the third hyperlink. 

Claim 19 (Previously Presented): The e-mail gateway according to claim 18, wherein 
the trusted server is programmed to perform further operations comprising: 

in response to a request received by the trusted server when the fourth hyperlink is 
selected, using the stored data to determine the third hyperlink corresponding to the selected 
fourth hyperlink and retrieving another object using the determined third hyperlink; 

scanning the retrieved other object in accordance with specified rules; 

making the retrieved other object available in response to the received request if the 
retrieved other object is determined to be acceptable in accordance with the specified rules; and 

performing remedial action if the retrieved other object is not determined to be acceptable 
in accordance with the specified rules. 



